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Timestazxip 

TI- start -time In seconds (since 1970 GMT) 
DU-duration o£ validity (for time grouping) 

Structural Fields 

6B-indicator that this row is an output o£ grouping 

operation 

MP -indicator that this row is a mapping or lookup row 

Key Fields (this category includes Secondary Key Fields) : 

CD-collection device (i.e. origin of the data) 
DA-destination MAC address (as. stated by ARP packet) 
DD-destination domain (DNS style) 
DX -destination IP number 

DM-destlnatlon MAC address (true MAC address) 
DN-normalised destination address 
DP-destination TCP port or UDP port 
EP -Ethernet protocol number 
PR- IP protocol number 

SA- source MAC address (as stated by ARP packet) 
SD- source domain (DNS style) 
SX- source IP nxxmber 

SM-source MAC address (true MAC address) 
SN-normalised source address 
SP- source TCP port or UDP port 

Secondary Key Fields (actually, special case of Key Fields) 

TF-traffic flow 
AC -account category 
SA- sub -account category 
CC-cost centre category 

Cotuiter fields 

BY- count of bytes 

PK-count of packets 
HT-count of web hits 



